<html>
<head><meta charset="utf-8"><title>https://github.com/rust-lang/rust/issues/63787 · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html">https://github.com/rust-lang/rust/issues/63787</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="173953597"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953597" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953597">(Aug 23 2019 at 09:08)</a>:</h4>
<p>I have some questions about this issue</p>



<a name="173953609"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953609" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953609">(Aug 23 2019 at 09:08)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> said that it was important to answer the question: Do we want non-repr(transparent)-structs containing references to be marked noalias?</p>



<a name="173953630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953630">(Aug 23 2019 at 09:08)</a>:</h4>
<p>but this question feels like the wrong question to ask to me.</p>



<a name="173953668"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953668" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953668">(Aug 23 2019 at 09:09)</a>:</h4>
<p>It boils down to answering the question: Do we want <code>struct Foo&lt;'a, T&gt;(&amp;'a mut T)</code> to be equivalent to <code>&amp;'a mut T</code> ?</p>



<a name="173953737"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953737" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953737">(Aug 23 2019 at 09:10)</a>:</h4>
<p>There, <code>Foo</code> is not <code>noalias</code>, its only field is.</p>



<a name="173953755"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953755" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953755">(Aug 23 2019 at 09:11)</a>:</h4>
<p>When calling <code>fn foo&lt;'a, T&gt;(x: Foo&lt;'a, T&gt;)</code>, whether <code>x</code> will be <code>noalias</code> or not, depends on the Abi of <code>Foo</code>, and the calling convention used.</p>



<a name="173953843"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953843" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953843">(Aug 23 2019 at 09:12)</a>:</h4>
<p>Everything about the LLVM IR generated is ultimately influenced by "encoding details" such as how we translate the Rust function signature to LLVM function signatures. That doesn't seem very interesting or relevant to me.</p>



<a name="173953870"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953870" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953870">(Aug 23 2019 at 09:12)</a>:</h4>
<p>The interesting bit is whether soundness requires encoding details in a particular way</p>



<a name="173953903"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953903" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953903">(Aug 23 2019 at 09:13)</a>:</h4>
<p>E.g. if a field is of reference type and part of a non-repr-transparent Adt then its ABI is not "Reference" but "RawPointer"</p>



<a name="173953951"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953951" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953951">(Aug 23 2019 at 09:14)</a>:</h4>
<p>a direct consequence being there is a big and subtle difference between <code>Foo</code> and <code>&amp;mut T</code></p>



<a name="173953989"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173953989" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173953989">(Aug 23 2019 at 09:15)</a>:</h4>
<p>If for silly reasons we don't communicate aliasing information we have to LLVM, then that's not a soundness issue, just a missed optimization.<br>
 I guess it's true that the real question could better be stated at a higher level (e.g., about retagging recursing into structures) which then justifies (or not) LLVM IR we generate, but this is just nitpicking IMO.</p>



<a name="173954001"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954001" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954001">(Aug 23 2019 at 09:15)</a>:</h4>
<p>The main question I have from that issue is whether the library types violate the "validity invariant" for references</p>



<a name="173954024"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954024" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954024">(Aug 23 2019 at 09:15)</a>:</h4>
<p>if we want references to be noalias, and their validity invariant makes sure that's always correct, how can passing Foo by memory or by value make a difference ?</p>



<a name="173954068"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954068" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954068">(Aug 23 2019 at 09:16)</a>:</h4>
<p>Validity of reference isn't what justifies <code>noalias</code>, never was</p>



<a name="173954100"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954100" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954100">(Aug 23 2019 at 09:16)</a>:</h4>
<p>I thought it was part of validity that, e.g., &amp;mut T references can't alias each other ?</p>



<a name="173954107"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954107" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954107">(Aug 23 2019 at 09:16)</a>:</h4>
<p>or is that only part of the aliasing model ?</p>



<a name="173954228"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954228" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954228">(Aug 23 2019 at 09:18)</a>:</h4>
<p>Leaving aside the question of how you'd even say that in the validity predicate, <code>noalias</code> holds for the entirety of the function while validity is only asserted at typed copies, so validity can't very well ensure <code>noalias</code> is applicable</p>



<a name="173954245"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954245" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954245">(Aug 23 2019 at 09:18)</a>:</h4>
<p>So how do we know when we can use <code>noalias</code> ?</p>



<a name="173954267"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954267" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954267">(Aug 23 2019 at 09:19)</a>:</h4>
<p>Stacked borrows (at least it's supposed to, there's open UCG issues about mismatches IIRC)</p>



<a name="173954269"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954269" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954269">(Aug 23 2019 at 09:19)</a>:</h4>
<p>In the examples, I have the feeling that we can make them correct, by instead of requiring <code>noalias</code> which holds for the whole function, using something else that only holds till last use.</p>



<a name="173954289"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954289" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954289">(Aug 23 2019 at 09:19)</a>:</h4>
<p>That's not <code>noalias</code> though</p>



<a name="173954292"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954292" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954292">(Aug 23 2019 at 09:19)</a>:</h4>
<p>No</p>



<a name="173954303"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954303" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954303">(Aug 23 2019 at 09:19)</a>:</h4>
<p>It would be something that probably doesn't exist in LLVM</p>



<a name="173954346"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954346" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954346">(Aug 23 2019 at 09:20)</a>:</h4>
<p>and for good reasons</p>



<a name="173954355"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954355" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954355">(Aug 23 2019 at 09:20)</a>:</h4>
<p>But <span class="user-mention" data-user-id="120791">@RalfJ</span> mentions that we could make this a language bug</p>



<a name="173954364"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954364" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954364">(Aug 23 2019 at 09:20)</a>:</h4>
<p>A language fix would be, e.g., to only require in the aliasing model for the reference to not alias till last use</p>



<a name="173954372"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954372" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954372">(Aug 23 2019 at 09:21)</a>:</h4>
<p>which doesn't hold for these examples, and therefore <code>noalias</code> would be incorrect</p>



<a name="173954388"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954388" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954388">(Aug 23 2019 at 09:21)</a>:</h4>
<p>where did he suggest that?</p>



<a name="173954392"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954392" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954392">(Aug 23 2019 at 09:21)</a>:</h4>
<p><a href="https://github.com/rust-lang/rust/issues/63787#issuecomment-523968728" target="_blank" title="https://github.com/rust-lang/rust/issues/63787#issuecomment-523968728">https://github.com/rust-lang/rust/issues/63787#issuecomment-523968728</a></p>



<a name="173954405"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954405" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954405">(Aug 23 2019 at 09:21)</a>:</h4>
<p>They suggest that we can make this either a language bug, or a library bug</p>



<a name="173954463"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954463" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954463">(Aug 23 2019 at 09:22)</a>:</h4>
<p>For this to be a library bug, <code>noalias</code> would need to be correct, which means that the aliasing model would somehow have to require on function arguments that references don't alias for the whole function</p>



<a name="173954476"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954476" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954476">(Aug 23 2019 at 09:22)</a>:</h4>
<p>For this to be a language bug, <code>noalias</code> would need to be incorrect, which means the language would not have to require the above, but something else</p>



<a name="173954481"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954481" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954481">(Aug 23 2019 at 09:23)</a>:</h4>
<p>I don't see the suggestion you describe there. On its own it just suggests we could fix the soundness issue by not using <code>noalias</code> there, which is true but doesn't imply we'll add anything more</p>



<a name="173954510"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954510" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954510">(Aug 23 2019 at 09:23)</a>:</h4>
<p>How do we justify no using <code>noalias</code> there is the question</p>



<a name="173954527"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954527" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954527">(Aug 23 2019 at 09:23)</a>:</h4>
<p>By changing how stacked borrows (or whatever else justifies noalias) treats newtypes around references, obviously</p>



<a name="173954590"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954590" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954590">(Aug 23 2019 at 09:24)</a>:</h4>
<p>It's unclear to me whether that's better than calling this a library bug</p>



<a name="173954607"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954607" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954607">(Aug 23 2019 at 09:25)</a>:</h4>
<p>Congratulations, you now have formed an opinion on the question at hand ;)</p>



<a name="173954611"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954611" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954611">(Aug 23 2019 at 09:25)</a>:</h4>
<p>I mean, without having an aliasing model at least, we can't really tell who is at fault here</p>



<a name="173954615"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954615" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954615">(Aug 23 2019 at 09:25)</a>:</h4>
<p>We can go either way</p>



<a name="173954623"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954623" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954623">(Aug 23 2019 at 09:25)</a>:</h4>
<p>That's precisely the question</p>



<a name="173954633"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954633" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954633">(Aug 23 2019 at 09:25)</a>:</h4>
<p>But fixing this at the library level is trivial, and fixing this at the language level requires subtle changes to the Abi and calling conventions</p>



<a name="173954681"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954681" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954681">(Aug 23 2019 at 09:26)</a>:</h4>
<p>I get the impression you've had your questions-about-the-question answered and are now thinking out loud. Have fun with that</p>



<a name="173954685"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954685" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954685">(Aug 23 2019 at 09:26)</a>:</h4>
<p>Thanks</p>



<a name="173954722"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/173954722" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#173954722">(Aug 23 2019 at 09:27)</a>:</h4>
<p>I'll think out loud in the issue</p>



<a name="174035298"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174035298" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174035298">(Aug 24 2019 at 11:24)</a>:</h4>
<p>we could say we only care about aliasing of "bare" references. that doesn't change anything about their ABI, but it does mean that newtyped references get fewer optimizations, which might be undesirable.</p>



<a name="174036203"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036203" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036203">(Aug 24 2019 at 11:56)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> </p>
<blockquote>
<p>I think we wall agree that it is legal to have C FFI with type Option&lt;&amp;mut T&gt; where C uses a pointer, right?</p>
</blockquote>
<p>Can you explain how could that work ?</p>



<a name="174036242"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036242" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036242">(Aug 24 2019 at 11:56)</a>:</h4>
<p>In C, <code>T*</code> and <code>T* restrict</code> are incompatible types, so you can't write a function definition using one, and write a declaration using the other, without invoking undefined behavior.</p>



<a name="174036247"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036247" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036247">(Aug 24 2019 at 11:57)</a>:</h4>
<p>Whether you provide the definition/declaration in Rust/C doesn't matter. That is, in C, the equivalent of:</p>



<a name="174036307"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036307" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036307">(Aug 24 2019 at 11:58)</a>:</h4>
<div class="codehilite"><pre><span></span><span class="c1">// crate A:</span>
<span class="k">pub</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span> <span class="nf">bar</span><span class="p">(</span><span class="n">x</span>: <span class="nc">NonNull</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="c1">// crate B:</span>
<span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">fn</span> <span class="nf">bar</span><span class="p">(</span><span class="n">x</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="n">T</span><span class="p">);</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="174036330"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036330" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036330">(Aug 24 2019 at 11:59)</a>:</h4>
<p>is UB.</p>



<a name="174036430"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036430" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036430">(Aug 24 2019 at 12:01)</a>:</h4>
<p>Because in the <code>bar</code> declaration <code>x</code> is <code>noalias</code>, in C at least it would be fine, e.g., using LTO, to make the <code>NonNull&lt;T&gt;</code> in the <code>bar</code> definition <code>noalias</code> as well.</p>



<a name="174036491"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036491" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036491">(Aug 24 2019 at 12:03)</a>:</h4>
<p>So if you are compiling Rust code with a <code>fn bar(x: &amp;mut T)</code> definition, and linking that with C code using <code>void bar(T* x)</code>, which calls <code>bar</code> with aliasing pointers, LTO could propagate <code>noalias</code> to <code>bar</code> C definition, and compile it under the assumption that <code>x</code> doesn't alias.</p>



<a name="174036533"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036533" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036533">(Aug 24 2019 at 12:04)</a>:</h4>
<p>That wouldn't break the Rust code calling it via <code>&amp;mut T</code>, but it might break other code that is using <code>NonNull&lt;T&gt;</code> to avoid <code>noalias</code></p>



<a name="174036587"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036587" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036587">(Aug 24 2019 at 12:06)</a>:</h4>
<p>I don't know if LLVM does this ""optimization"", but it could.</p>



<a name="174036596"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036596" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036596">(Aug 24 2019 at 12:07)</a>:</h4>
<p>E.g. a C header file can declare <code>void foo(T* restrict x);</code> and the C implementation file can implement it as <code>void foo(T* x) { ... }</code>, and you'd definitely want to make use of the fact that <code>x</code> is <code>noalias</code> when compiling the implementation</p>



<a name="174036753"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036753" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036753">(Aug 24 2019 at 12:12)</a>:</h4>
<blockquote>
<p><span class="user-mention silent" data-user-id="120791">RalfJ</span> </p>
<blockquote>
<p>I think we wall agree that it is legal to have C FFI with type Option&lt;&amp;mut T&gt; where C uses a pointer, right?</p>
</blockquote>
<p>Can you explain how could that work ?</p>
</blockquote>
<p>AFAIK many people do it? I recall being told by various people that this is a good way to write your FFI.  And why would it not work? The FFI lint was even adjusted to be fine with this, IIRC. I am very confused about your opposition here.</p>
<p>As I said on GH, I don't think C's rules are very relevant unless LLVM copies them -- but in LLVM, attributes dont affect ABI.</p>



<a name="174036755"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036755" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036755">(Aug 24 2019 at 12:12)</a>:</h4>
<p>also, do you know why C declares them incompatible? I don't quite see the point.</p>



<a name="174036764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036764">(Aug 24 2019 at 12:13)</a>:</h4>
<p>Similar to how in rust, <code>mut</code> isnt part  of the signature (as in <code>fn foo(mut x: i32)</code>, the same should apply to the aliasing stuff</p>



<a name="174036842"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036842" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036842">(Aug 24 2019 at 12:15)</a>:</h4>
<blockquote>
<p>[...] in LLVM, attributes dont affect ABI.</p>
</blockquote>
<p>NB this is not generally true, consider <code>sret</code> or <code>zeroext</code> for example. I think it's true for <code>noalias</code> tho</p>



<a name="174036893"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174036893" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174036893">(Aug 24 2019 at 12:17)</a>:</h4>
<p>hm okay. I was thinking of things like <code>readonly</code> etc as well</p>



<a name="174037215"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037215" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037215">(Aug 24 2019 at 12:26)</a>:</h4>
<p>To be more specific, in C, the following program has undefined behavior:</p>
<div class="codehilite"><pre><span></span><span class="kt">int</span> <span class="nf">foo</span><span class="p">(</span><span class="kt">int</span><span class="o">*</span> <span class="kr">restrict</span> <span class="n">x</span><span class="p">,</span> <span class="kt">int</span><span class="o">*</span> <span class="kr">restrict</span> <span class="n">y</span><span class="p">);</span>
<span class="kt">int</span> <span class="nf">foo</span><span class="p">(</span><span class="kt">int</span><span class="o">*</span> <span class="n">x</span><span class="p">,</span> <span class="kt">int</span><span class="o">*</span> <span class="n">y</span><span class="p">)</span> <span class="p">{</span> <span class="k">return</span> <span class="o">*</span><span class="n">x</span> <span class="o">+</span> <span class="o">*</span><span class="n">y</span><span class="p">;</span> <span class="p">}</span>
</pre></div>


<p>Because the definition and the declaration must be compatible per C11 6.2.7p2 (<a href="https://port70.net/~nsz/c/c11/n1570.html#6.2.7p2" target="_blank" title="https://port70.net/~nsz/c/c11/n1570.html#6.2.7p2">https://port70.net/~nsz/c/c11/n1570.html#6.2.7p2</a>) says:</p>
<blockquote>
<p>All declarations that refer to the same object or function shall have compatible type; otherwise, the behavior is undefined.</p>
</blockquote>
<p>For two function prototypes to be compatible, the function argument types must be compatible, per C11 6.7.6.3p15 (<a href="https://port70.net/~nsz/c/c11/n1570.html#6.7.6.3p15" target="_blank" title="https://port70.net/~nsz/c/c11/n1570.html#6.7.6.3p15">https://port70.net/~nsz/c/c11/n1570.html#6.7.6.3p15</a>):</p>
<blockquote>
<p>For two function types to be compatible, [...] corresponding parameters shall have compatible types</p>
</blockquote>
<p>And two pointer types are only compatible if they are identically cvr-qualified, per C11 6.7.6.1p2 (<a href="https://port70.net/~nsz/c/c11/n1570.html#6.7.6.1p2" target="_blank" title="https://port70.net/~nsz/c/c11/n1570.html#6.7.6.1p2">https://port70.net/~nsz/c/c11/n1570.html#6.7.6.1p2</a>) says:</p>
<blockquote>
<p>For two pointer types to be compatible, both shall be identically qualified and both shall be pointers to compatible types.</p>
</blockquote>



<a name="174037225"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037225" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037225">(Aug 24 2019 at 12:27)</a>:</h4>
<p>I believe you that it does, but is there a good reason for this?</p>



<a name="174037269"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037269" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037269">(Aug 24 2019 at 12:28)</a>:</h4>
<p>It's quite common to properly qualify a declaration in a header file, which is where the API is specified, and then do "whatever" in the definition.</p>



<a name="174037273"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037273" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037273">(Aug 24 2019 at 12:28)</a>:</h4>
<p>C allows, for example, this code: </p>
<div class="codehilite"><pre><span></span><span class="kt">int</span> <span class="nf">foo</span><span class="p">();</span>
<span class="kt">int</span> <span class="nf">foo</span><span class="p">(</span><span class="kt">int</span><span class="o">*</span> <span class="n">x</span><span class="p">,</span> <span class="kt">int</span><span class="o">*</span> <span class="n">y</span><span class="p">)</span> <span class="p">{</span> <span class="k">return</span> <span class="o">*</span><span class="n">x</span> <span class="o">+</span> <span class="o">*</span><span class="n">y</span><span class="p">;</span> <span class="p">}</span>
</pre></div>



<a name="174037280"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037280" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037280">(Aug 24 2019 at 12:29)</a>:</h4>
<p>for compatibility with C89</p>



<a name="174037290"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037290" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037290">(Aug 24 2019 at 12:29)</a>:</h4>
<p>So backward compatibility with code written that way is probably a main reason as well.</p>



<a name="174037354"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037354" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037354">(Aug 24 2019 at 12:31)</a>:</h4>
<p>how does adding more UB help with backwards compatibility?</p>



<a name="174037683"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037683" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037683">(Aug 24 2019 at 12:40)</a>:</h4>
<p>There are two issues. C does not require putting arguments on declarations. If you don't, the argument type must match exactly when calling the function, or else UB. If you do put the arguments on the declaration, they must precisely match, or else UB - independently of whether the function is called at all.</p>



<a name="174037694"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037694" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037694">(Aug 24 2019 at 12:41)</a>:</h4>
<p>(deleted)</p>



<a name="174037711"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037711" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037711">(Aug 24 2019 at 12:42)</a>:</h4>
<p>(deleted)</p>



<a name="174037768"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037768" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037768">(Aug 24 2019 at 12:43)</a>:</h4>
<p>IIUC you want this to be correct UB free Rust code:</p>
<div class="codehilite"><pre><span></span><span class="c1">// crate A:</span>
<span class="k">pub</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="c1">// crate B:</span>
<span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">);</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="174037846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174037846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174037846">(Aug 24 2019 at 12:46)</a>:</h4>
<p>If that code is correct, then we need to find a way to precisely word why using the <code>foo</code> declaration according to its signature violates the validity invariant. </p>
<div class="codehilite"><pre><span></span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">..;</span><span class="w"></span>
<span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">foo</span><span class="p">(</span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">_</span><span class="p">,</span><span class="w"> </span><span class="o">&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="w"> </span><span class="k">as</span><span class="w"> </span><span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">_</span><span class="p">)</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</pre></div>


<p>We can say that the <code>foo</code> declaration is "valid" (aka not instant UB), but that passing it pointers that do not alias is part of its "safety" invariant (which isn't documented anywhere), and that the <code>unsafe { ... }</code> block violates it.</p>



<a name="174038023"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174038023" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174038023">(Aug 24 2019 at 12:50)</a>:</h4>
<p>In C, the declaration itself is "invalid" because in C <code>T* restrict</code> is not compatible with <code>T*</code>. </p>
<p>In Rust we can say  that <code>Option&lt;&amp;mut T&gt;</code>/<code>Option&lt;&amp;T&gt;</code> are compatible with either <code>T*</code> _OR_ <code>T* restrict</code>, but not both, because these two types are incompatible. Since the Rust pointer types are <code>noalias</code>, I'd rather pick <code>T* restrict</code>. Otherwise:</p>
<div class="codehilite"><pre><span></span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</pre></div>


<p>cannot be called using non-aliasing pointer types from C, which is a requirement that C would place on calling such a function.</p>



<a name="174038092"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174038092" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174038092">(Aug 24 2019 at 12:52)</a>:</h4>
<p>Why C does things this way would matter if we could change how C does things. It would be cool if you could use a function like this:</p>
<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">foo</span><span class="p">(</span><span class="n">T</span><span class="o">*</span> <span class="n">x</span><span class="p">,</span> <span class="n">T</span><span class="o">*</span> <span class="n">y</span><span class="p">)</span> <span class="p">{</span> <span class="p">...</span> <span class="p">}</span>
</pre></div>


<p>via a <code>void foo(T* restrict, T* restrict);</code> prototype from a context in which you know that the pointers will never alias. That would allow calling such a function from Rust using <code>Option&lt;&amp;mut T&gt;</code> instead of <code>*mut T</code>.</p>



<a name="174044637"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174044637" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174044637">(Aug 24 2019 at 16:07)</a>:</h4>
<blockquote>
<p>In Rust we can say that Option&lt;&amp;mut T&gt;/Option&lt;&amp;T&gt; are compatible with either T* _OR_ T* restrict, but not both</p>
</blockquote>
<p>I disagree. They are incompatible on the C language level but we do not care about that, we only care about the ABI level, and there they are fine.</p>



<a name="174044681"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174044681" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174044681">(Aug 24 2019 at 16:08)</a>:</h4>
<blockquote>
<p>Why C does things this way would matter if we could change how C does things</p>
</blockquote>
<p>no, it also matters to understand the rules. maybe there is a good reason. but if it's just C being silly, and LLVM didnt copy that silliness, there is no reason for us to even talk about it.</p>



<a name="174044694"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174044694" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174044694">(Aug 24 2019 at 16:09)</a>:</h4>
<blockquote>
<p>IIUC you want this to be correct UB free Rust code:</p>
<div class="codehilite"><pre><span></span><span class="c1">// crate A:</span>
<span class="k">pub</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="c1">// crate B:</span>
<span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">);</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>


</blockquote>
<p>we already guarantee that this works, IMO: <a href="https://rust-lang.github.io/unsafe-code-guidelines/layout/enums.html#discriminant-elision-on-option-like-enums" target="_blank" title="https://rust-lang.github.io/unsafe-code-guidelines/layout/enums.html#discriminant-elision-on-option-like-enums">https://rust-lang.github.io/unsafe-code-guidelines/layout/enums.html#discriminant-elision-on-option-like-enums</a></p>



<a name="174044743"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174044743" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174044743">(Aug 24 2019 at 16:10)</a>:</h4>
<p>together with <a href="https://rust-lang.github.io/unsafe-code-guidelines/layout/pointers.html" target="_blank" title="https://rust-lang.github.io/unsafe-code-guidelines/layout/pointers.html">https://rust-lang.github.io/unsafe-code-guidelines/layout/pointers.html</a>:</p>
<blockquote>
<p>The layouts of &amp;T, &amp;mut T, *const T and *mut T are the same.</p>
</blockquote>



<a name="174055381"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055381" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055381">(Aug 24 2019 at 21:33)</a>:</h4>
<blockquote>
<p>I disagree. They are incompatible on the C language level but we do not care about that, we only care about the ABI level, and there they are fine.</p>
</blockquote>
<p>This bans cross-lang-LTO</p>



<a name="174055429"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055429" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055429">(Aug 24 2019 at 21:34)</a>:</h4>
<p>xLTO happens on the LLVM IR level, what are you talking about?</p>



<a name="174055432"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055432" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055432">(Aug 24 2019 at 21:34)</a>:</h4>
<p>Or would at least impose some extra requirements on it</p>



<a name="174055447"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055447" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055447">(Aug 24 2019 at 21:35)</a>:</h4>
<p>hmm, wait, in LLVM-IR, noalias is not part of fn declarations right ?</p>



<a name="174055498"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055498" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055498">(Aug 24 2019 at 21:37)</a>:</h4>
<p>it is</p>



<a name="174055544"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055544" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055544">(Aug 24 2019 at 21:38)</a>:</h4>
<p><span class="user-mention" data-user-id="124289">@rkruppe</span> two llvm modules, one with a declaration <code>declare void @foo(i32* noalias);</code> and one with a definition <code>define void @foo(i32* %0) { ... }</code></p>



<a name="174055546"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055546" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055546">(Aug 24 2019 at 21:38)</a>:</h4>
<p>a valid optimization for C would be to make the <code>i32*</code> in the definition <code>noalias</code>, because a declaration exists that makes it <code>noalias</code></p>



<a name="174055555"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055555" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055555">(Aug 24 2019 at 21:39)</a>:</h4>
<p>For most (all?) of this thread so far you've argued in terms of C level types and rules, which is plainly irrelevant on LLVM IR level (and hence, irrelevant for xLTO)</p>



<a name="174055558"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055558" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055558">(Aug 24 2019 at 21:39)</a>:</h4>
<p>the declaration containing noalias could come from Rust code, the definition could be C code</p>



<a name="174055603"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055603" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055603">(Aug 24 2019 at 21:40)</a>:</h4>
<p>If you think there is an issue with the LLVM IR and optimizations on it (in the face of xLTO or otherwise) then <strong>please</strong> state it on that level, don't mix in different abstraction levels</p>



<a name="174055605"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055605" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055605">(Aug 24 2019 at 21:40)</a>:</h4>
<p><code>noalias</code> in LLVM-IR is modeled after C restrict</p>



<a name="174055666"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055666" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055666">(Aug 24 2019 at 21:42)</a>:</h4>
<p><span class="user-mention" data-user-id="124289">@rkruppe</span> it is a problem on all levels</p>



<a name="174055674"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055674" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055674">(Aug 24 2019 at 21:43)</a>:</h4>
<p>Problem 1 is that xLTO makes Rust and C visible to each other</p>



<a name="174055718"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055718" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055718">(Aug 24 2019 at 21:44)</a>:</h4>
<p>Problem 2 is that Option&lt;&amp;mut T&gt; can't be equivalent to both T* and T* restrict because they are not equivalent</p>



<a name="174055732"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055732" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055732">(Aug 24 2019 at 21:45)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span>  is correct in that the layout of <em>mut T and &amp;mut T and T</em> and T* restrict is the same</p>



<a name="174055733"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055733" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055733">(Aug 24 2019 at 21:45)</a>:</h4>
<p>It mixes <strong>LLVM IR</strong> generated from both languages. So for example the stuff about cvr-qualified types you cited earlier is only relevant if and insofar it is reflected in the IR semantics. So whatever the problem is, I am very sure you can state it in terms of LLVM IR, which is also the best way to make it legible.</p>



<a name="174055777"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055777" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055777">(Aug 24 2019 at 21:46)</a>:</h4>
<p>but that does not mean that *mut T and &amp;mut T can be freely substituted for each other</p>



<a name="174055782"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055782" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055782">(Aug 24 2019 at 21:46)</a>:</h4>
<p>It clearly already doesn't mean that by Rust's rules alone, so this is not exactly a revelation</p>



<a name="174055789"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055789" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055789">(Aug 24 2019 at 21:47)</a>:</h4>
<p>Yes, if you use <code>&amp;mut T</code> in FFI signatures that also implies aliasing restrictions for the other side of the FFI. That's a far cry from there being an automatic ABI incompatibility.</p>



<a name="174055846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055846">(Aug 24 2019 at 21:49)</a>:</h4>
<p>If C could see the declaration with mismatching cvr-quals, the behavior would be instantaneously undefined, per C own rules</p>



<a name="174055897"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055897" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055897">(Aug 24 2019 at 21:50)</a>:</h4>
<p>that's the problem, not ABI incompatibility - for ABI incompatibility, you'd at least need to call the function to trigger UB</p>



<a name="174055909"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055909" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055909">(Aug 24 2019 at 21:51)</a>:</h4>
<p>I don't know how many more ways I can find to say that this is irrelevant because the interop and xLTO is in terms of LLVM IR, not C source code. I feel like I'm not getting this point through to you.</p>



<a name="174055944"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055944" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055944">(Aug 24 2019 at 21:52)</a>:</h4>
<p>In terms of LLVM-IR, the question is whether mismatching declarations and definitions when it comes to <code>noalias</code> are ok</p>



<a name="174055960"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055960" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055960">(Aug 24 2019 at 21:52)</a>:</h4>
<p>Finally we agree on what's even the right question to ask ;)</p>



<a name="174055984"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174055984" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174055984">(Aug 24 2019 at 21:53)</a>:</h4>
<p>A mismatch in the set of attributes isn't a problem per se. For example, attribute inference might add all sorts of attributes in one module where the body is visible, while being unable to affect the declarations in other modules. I see no reason why noalias would be different.</p>



<a name="174056040"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056040" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056040">(Aug 24 2019 at 21:55)</a>:</h4>
<p>With LTO, could LLVM propagate noalias in a declaration to a definition in another module ?</p>



<a name="174056049"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056049" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056049">(Aug 24 2019 at 21:55)</a>:</h4>
<p>It's going to merge the attributes (or pick one of the signatures) ~somehow~ I guess</p>



<a name="174056092"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056092" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056092">(Aug 24 2019 at 21:56)</a>:</h4>
<p>That could be problematic if it were to happen</p>



<a name="174056097"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056097" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056097">(Aug 24 2019 at 21:56)</a>:</h4>
<p>I don't see why this is all that interesting though. If the <code>noalias</code> is present <em>anywhere</em> and it's violated by passing aliasing pointers, that's UB right then and there, even if it may not be visible to the optimizer which looks at any particular module (or even set of modules).</p>



<a name="174056098"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056098" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056098">(Aug 24 2019 at 21:56)</a>:</h4>
<p>E.g. if C generates a definition without noalias, but because Rust uses <code>Option&lt;&amp;mut T&gt;</code> in a declaration , LLVM merges them applying noalias to the definiton, something that the original C code did not do, and optimize the definition based on that</p>



<a name="174056105"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056105" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056105">(Aug 24 2019 at 21:57)</a>:</h4>
<p>Then some C code calls the definition with aliasing pointers, which would have been ok</p>



<a name="174056145"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056145" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056145">(Aug 24 2019 at 21:58)</a>:</h4>
<p>but because of the Rust declaration, now it is not</p>



<a name="174056150"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056150" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056150">(Aug 24 2019 at 21:58)</a>:</h4>
<p>The Rust code using <code>Option&lt;&amp;mut T&gt;</code> might never pass aliasing pointers</p>



<a name="174056151"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056151" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056151">(Aug 24 2019 at 21:58)</a>:</h4>
<p>That isn't the issue</p>



<a name="174056153"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056153" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056153">(Aug 24 2019 at 21:58)</a>:</h4>
<p>Oh I guess this is the same problem as <a href="https://github.com/rust-lang/rust/issues/46188" target="_blank" title="https://github.com/rust-lang/rust/issues/46188">https://github.com/rust-lang/rust/issues/46188</a></p>



<a name="174056161"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056161" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056161">(Aug 24 2019 at 21:59)</a>:</h4>
<p>I didn't knew about this issue</p>



<a name="174056162"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056162" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056162">(Aug 24 2019 at 21:59)</a>:</h4>
<p>but that's exactly what I had in mind</p>



<a name="174056205"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056205" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056205">(Aug 24 2019 at 22:00)</a>:</h4>
<p>The question is, can this also happen in Rust code ?</p>



<a name="174056214"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056214" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056214">(Aug 24 2019 at 22:00)</a>:</h4>
<div class="codehilite"><pre><span></span><span class="c1">// crate A:</span>
<span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="c1">// crate B:</span>
<span class="k">extern</span><span class="w"> </span><span class="s">&quot;Rust&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">);</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</pre></div>



<a name="174056225"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056225" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056225">(Aug 24 2019 at 22:01)</a>:</h4>
<p>Could the declaration in crate B result in <code>x</code> and <code>y</code> in the definition becoming <code>noalias</code> after LLVM optimizations ?</p>



<a name="174056226"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056226" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056226">(Aug 24 2019 at 22:01)</a>:</h4>
<p>Sure, why not</p>



<a name="174056231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056231">(Aug 24 2019 at 22:01)</a>:</h4>
<p>So then it isn't ok</p>



<a name="174056273"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056273" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056273">(Aug 24 2019 at 22:02)</a>:</h4>
<p><code>Option&lt;&amp;mut T&gt;</code> is not a type that you can use in an FFI declaration to interface with any pointer type at the other side</p>



<a name="174056274"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056274" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056274">(Aug 24 2019 at 22:02)</a>:</h4>
<p>that's too strong a conclusion</p>



<a name="174056275"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056275" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056275">(Aug 24 2019 at 22:02)</a>:</h4>
<p>yes, i suppose we can be more careful with not emitting <code>noalias</code> in declarations</p>



<a name="174056280"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056280" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056280">(Aug 24 2019 at 22:03)</a>:</h4>
<p>that's not what i meant</p>



<a name="174056324"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056324" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056324">(Aug 24 2019 at 22:04)</a>:</h4>
<p>a declaration using <code>Option&lt;&amp;mut T&gt;</code> implying it's noalias (and deref'able, and aligned, and ...) can be fine w.r.t. the definition, if it requires all those things anyway</p>



<a name="174056337"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056337" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056337">(Aug 24 2019 at 22:05)</a>:</h4>
<p>yes</p>



<a name="174056339"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056339" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056339">(Aug 24 2019 at 22:05)</a>:</h4>
<p>it could also be always fine, even if the definition doesn't require any of those</p>



<a name="174056386"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056386" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056386">(Aug 24 2019 at 22:06)</a>:</h4>
<p>we could say that it is a feature that you can write a definition without requirements, and that if you have a piece of code where you only use it with some requirements met, you can declare it with a "stronger" signature, and use that instead</p>



<a name="174056453"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174056453" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174056453">(Aug 24 2019 at 22:09)</a>:</h4>
<p>either way, this should be an explicit design decision, and not something that happens by accident</p>



<a name="174075528"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174075528" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174075528">(Aug 25 2019 at 08:40)</a>:</h4>
<blockquote>
<div class="codehilite"><pre><span></span><span class="c1">// crate A:</span>
<span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="c1">// crate B:</span>
<span class="k">extern</span><span class="w"> </span><span class="s">&quot;Rust&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">);</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</pre></div>


</blockquote>
<p>won't the Rust stuff be mangled? Isn't this only a problem for <code>extern "C"</code> because there is no mangling?</p>



<a name="174075535"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174075535" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174075535">(Aug 25 2019 at 08:40)</a>:</h4>
<p>or maybe mangling is always disabled for <code>extern</code>? I don't have a good model of <code>extern "Rust"</code></p>



<a name="174075723"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174075723" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174075723">(Aug 25 2019 at 08:46)</a>:</h4>
<p>to my knowledge, there's quite a bit of code out there that uses references (with or without <code>Option</code>) on the Rust side of an <code>extern "C"</code> function. some people say this helps them avoid mistakes when writing the FFI glue code.<br>
For the case without <code>Option</code>, <a href="https://doc.rust-lang.org/nightly/nomicon/ffi.html#interoperability-with-foreign-code" target="_blank" title="https://doc.rust-lang.org/nightly/nomicon/ffi.html#interoperability-with-foreign-code">https://doc.rust-lang.org/nightly/nomicon/ffi.html#interoperability-with-foreign-code</a> IMO says this is okay for references (and <code>Box</code>, when done right -- also see <a href="https://github.com/rust-lang/rust/pull/62514" target="_blank" title="https://github.com/rust-lang/rust/pull/62514">https://github.com/rust-lang/rust/pull/62514</a>).<br>
For the case with <code>Option</code>, <a href="https://doc.rust-lang.org/nightly/nomicon/ffi.html#the-nullable-pointer-optimization" target="_blank" title="https://doc.rust-lang.org/nightly/nomicon/ffi.html#the-nullable-pointer-optimization">https://doc.rust-lang.org/nightly/nomicon/ffi.html#the-nullable-pointer-optimization</a> says very explicitly that this is okay for function pointers<br>
I read the UCG documents as saying that this is also okay for references with and without <code>Option</code>.<br>
For all of these cases we rely on it being okay in LLVM to have a function defined without <code>noalias</code> or <code>dereferencable</code>, and then to call it through a declaration with <code>noalias</code> etc.</p>



<a name="174076479"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076479" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076479">(Aug 25 2019 at 09:13)</a>:</h4>
<blockquote>
<p>I don't have a good model of extern "Rust"</p>
</blockquote>
<p>You do: <code>extern "Rust" fn</code> and <code>fn</code> are two ways of writing the same thing.</p>



<a name="174076524"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076524" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076524">(Aug 25 2019 at 09:14)</a>:</h4>
<blockquote>
<p>For the case without Option, <a href="https://doc.rust-lang.org/nightly/nomicon/ffi.html#interoperability-with-foreign-code" target="_blank" title="https://doc.rust-lang.org/nightly/nomicon/ffi.html#interoperability-with-foreign-code">https://doc.rust-lang.org/nightly/nomicon/ffi.html#interoperability-with-foreign-code</a> IMO says this is okay for references (and Box, when done right -- also see <a href="https://github.com/rust-lang/rust/pull/62514" target="_blank" title="https://github.com/rust-lang/rust/pull/62514">https://github.com/rust-lang/rust/pull/62514</a>).</p>
</blockquote>
<p>That is probably wrong, or at least, it did not consider all aspects of the problem. cc <span class="user-mention" data-user-id="137587">@Gankra</span></p>



<a name="174076525"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076525" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076525">(Aug 25 2019 at 09:14)</a>:</h4>
<p>but fur <code>extern "Rust"</code> blocks... is there any name mangling?</p>



<a name="174076530"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076530" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076530">(Aug 25 2019 at 09:14)</a>:</h4>
<p>Rust one</p>



<a name="174076533"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076533" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076533">(Aug 25 2019 at 09:14)</a>:</h4>
<p>All Rust functions are <code>extern "Rust"</code></p>



<a name="174076541"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076541" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076541">(Aug 25 2019 at 09:15)</a>:</h4>
<p>You just don't have to write it</p>



<a name="174076543"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076543" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076543">(Aug 25 2019 at 09:15)</a>:</h4>
<p>I am talking specifically about extern <em>blocks</em></p>



<a name="174076546"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076546" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076546">(Aug 25 2019 at 09:15)</a>:</h4>
<p>I know</p>



<a name="174076552"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076552" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076552">(Aug 25 2019 at 09:15)</a>:</h4>
<p>That provides declarations with some ABI</p>



<a name="174076554"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076554" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076554">(Aug 25 2019 at 09:15)</a>:</h4>
<p>normal fns are not in an extern block, so your "all rust fns are" doesn't apply</p>



<a name="174076595"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076595" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076595">(Aug 25 2019 at 09:16)</a>:</h4>
<p><code>fn foo() { ... }</code> is _exactly the same_ as <code>extern "Rust" fn foo() { ... }</code></p>



<a name="174076598"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076598" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076598">(Aug 25 2019 at 09:16)</a>:</h4>
<p>yes and that has nothing to do with my question :)</p>



<a name="174076599"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076599" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076599">(Aug 25 2019 at 09:16)</a>:</h4>
<p>and if extern blocks have mangling that would mean it matters in which crate/module you define them? that makes little sense...</p>



<a name="174076602"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076602" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076602">(Aug 25 2019 at 09:16)</a>:</h4>
<p>when you call <code>foo</code> via <code>other_crate::foo()</code> that's exactly the same as doing <code>extern "Rust" { fn other_crate_foo() }</code> and calling that</p>



<a name="174076611"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076611" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076611">(Aug 25 2019 at 09:17)</a>:</h4>
<p>extern blocks have mangling</p>



<a name="174076615"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076615" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076615">(Aug 25 2019 at 09:17)</a>:</h4>
<blockquote>
<p>when you call <code>foo</code> via <code>other_crate::foo()</code> that's exactly the same as doing <code>extern "Rust" { fn other_crate_foo() }</code> and calling that</p>
</blockquote>
<p>I dont think that can be right.</p>



<a name="174076617"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076617" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076617">(Aug 25 2019 at 09:17)</a>:</h4>
<p>the mangling of the ABI you choose (for C, that's none)</p>



<a name="174076656"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076656" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076656">(Aug 25 2019 at 09:18)</a>:</h4>
<p>how does it figure out the module name etc?</p>



<a name="174076657"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076657" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076657">(Aug 25 2019 at 09:18)</a>:</h4>
<p>Good question</p>



<a name="174076659"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076659" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076659">(Aug 25 2019 at 09:18)</a>:</h4>
<p>In this case, they are in the same crate</p>



<a name="174076660"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076660" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076660">(Aug 25 2019 at 09:18)</a>:</h4>
<p>so that isn't an issue</p>



<a name="174076662"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076662" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076662">(Aug 25 2019 at 09:18)</a>:</h4>
<p>in different crates, I don't know</p>



<a name="174076666"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076666" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076666">(Aug 25 2019 at 09:19)</a>:</h4>
<p>The reference doesn't say</p>



<a name="174076669"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076669" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076669">(Aug 25 2019 at 09:19)</a>:</h4>
<p>no mangling: <a href="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=6f976fe163c70645529ae6e1b15fd82a" target="_blank" title="https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=6f976fe163c70645529ae6e1b15fd82a">https://play.rust-lang.org/?version=stable&amp;mode=debug&amp;edition=2018&amp;gist=6f976fe163c70645529ae6e1b15fd82a</a></p>



<a name="174076671"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076671" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076671">(Aug 25 2019 at 09:19)</a>:</h4>
<p>(let it generate LLVM IR)</p>



<a name="174076721"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076721" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076721">(Aug 25 2019 at 09:20)</a>:</h4>
<p>So you'd need to write the appropriate <code>#[link_name]</code></p>



<a name="174076725"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076725" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076725">(Aug 25 2019 at 09:20)</a>:</h4>
<p>or make the Rust item <code>#[no_mangle]</code></p>



<a name="174076727"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076727" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076727">(Aug 25 2019 at 09:20)</a>:</h4>
<p>we should write that down in the reference</p>



<a name="174076735"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076735" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076735">(Aug 25 2019 at 09:21)</a>:</h4>
<p>so I don't think your <code>foo</code> example above is an issue -- but if one would do the right mangling manually, it could be. that essentially a duplicate of <a href="https://github.com/rust-lang/rust/issues/28179" target="_blank" title="https://github.com/rust-lang/rust/issues/28179">https://github.com/rust-lang/rust/issues/28179</a> though.</p>



<a name="174076740"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076740" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076740">(Aug 25 2019 at 09:21)</a>:</h4>
<blockquote>
<p>we should write that down in the reference</p>
</blockquote>
<p>yeah... <a href="https://doc.rust-lang.org/reference/items/external-blocks.html" target="_blank" title="https://doc.rust-lang.org/reference/items/external-blocks.html">https://doc.rust-lang.org/reference/items/external-blocks.html</a> should probably say that there is no mangling?</p>



<a name="174076840"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076840" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076840">(Aug 25 2019 at 09:24)</a>:</h4>
<p>I dont think this has anything to do with <a href="https://github.com/rust-lang/rust/issues/28179" target="_blank" title="https://github.com/rust-lang/rust/issues/28179">#28179</a> .</p>



<a name="174076844"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076844" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076844">(Aug 25 2019 at 09:24)</a>:</h4>
<div class="codehilite"><pre><span></span><span class="c1">// crate A:</span>
<span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="c1">// crate B:</span>
<span class="k">extern</span><span class="w"> </span><span class="s">&quot;Rust&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="k">fn</span> <span class="cp">$mangled_foo</span><span class="p">(</span><span class="n">x</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="n">y</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="o">&gt;</span><span class="p">);</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
</pre></div>



<a name="174076845"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076845" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076845">(Aug 25 2019 at 09:24)</a>:</h4>
<p>has the same issue, no <code>#[no_mangle]</code> involved</p>



<a name="174076846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076846">(Aug 25 2019 at 09:24)</a>:</h4>
<p>(resolved)</p>



<a name="174076895"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076895" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076895">(Aug 25 2019 at 09:26)</a>:</h4>
<p>You don't need any unsafe Rust code to make <code>foo</code> arguments noalias in its definition.</p>



<a name="174076907"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076907" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076907">(Aug 25 2019 at 09:27)</a>:</h4>
<p>And we have a well defined mangling scheme, so you could have a <code>build.rs</code> generate <code>$mangled_foo</code> and a macro expand it.</p>



<a name="174076952"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076952" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076952">(Aug 25 2019 at 09:28)</a>:</h4>
<p>This is a duplicate of <a href="https://github.com/rust-lang/rust/issues/46188" target="_blank" title="https://github.com/rust-lang/rust/issues/46188">https://github.com/rust-lang/rust/issues/46188</a></p>



<a name="174076956"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174076956" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174076956">(Aug 25 2019 at 09:28)</a>:</h4>
<p>It just happens that that issue is not restricted to <code>extern "C"</code></p>



<a name="174077147"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174077147" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174077147">(Aug 25 2019 at 09:35)</a>:</h4>
<p>FWIW for <code>noalias</code>, at least right now, LLVM doesn't do this: <a href="https://llvm.godbolt.org/z/EPE_hE" target="_blank" title="https://llvm.godbolt.org/z/EPE_hE">https://llvm.godbolt.org/z/EPE_hE</a></p>



<a name="174077150"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174077150" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174077150">(Aug 25 2019 at 09:35)</a>:</h4>
<blockquote>
<p>has the same issue, no <code>#[no_mangle]</code> involved</p>
</blockquote>
<p>yeah, not exactly the same issue but similar. there's also one there with <code>link_name</code> or so</p>



<a name="174077153"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174077153" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174077153">(Aug 25 2019 at 09:35)</a>:</h4>
<p>It inlines <code>foo</code> and applies <code>noalias</code> to a copy of <code>foo</code></p>



<a name="174077196"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174077196" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174077196">(Aug 25 2019 at 09:36)</a>:</h4>
<p>(for noalias in argument position)</p>



<a name="174077648"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174077648" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174077648">(Aug 25 2019 at 09:52)</a>:</h4>
<p>Boom: <a href="https://llvm.godbolt.org/z/POZ7Xw" target="_blank" title="https://llvm.godbolt.org/z/POZ7Xw">https://llvm.godbolt.org/z/POZ7Xw</a></p>



<a name="174077650"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174077650" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174077650">(Aug 25 2019 at 09:52)</a>:</h4>
<p>It does happen for noalias in argument position</p>



<a name="174077656"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174077656" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174077656">(Aug 25 2019 at 09:53)</a>:</h4>
<p>(try commenting out the <code>cfg(...)</code>, and see how the declarations are merged)</p>



<a name="174077714"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174077714" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174077714">(Aug 25 2019 at 09:54)</a>:</h4>
<p>What I haven't been able to trigger is to have that actually add <code>noalias</code> to a definition.</p>



<a name="174078087"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174078087" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174078087">(Aug 25 2019 at 10:07)</a>:</h4>
<blockquote>
<p>Boom: <a href="https://llvm.godbolt.org/z/POZ7Xw" target="_blank" title="https://llvm.godbolt.org/z/POZ7Xw">https://llvm.godbolt.org/z/POZ7Xw</a></p>
</blockquote>
<p>so, what is that demonstrating?</p>



<a name="174078090"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174078090" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174078090">(Aug 25 2019 at 10:07)</a>:</h4>
<p>looks like a fn ptr transmute to me</p>



<a name="174078093"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174078093" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174078093">(Aug 25 2019 at 10:07)</a>:</h4>
<p>ah LLVM is applying the declaration of one fn to the other?</p>



<a name="174078343"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174078343" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174078343">(Aug 25 2019 at 10:14)</a>:</h4>
<p>yes</p>



<a name="174078362"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174078362" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174078362">(Aug 25 2019 at 10:15)</a>:</h4>
<p>LLVM transforms <code>declare void @foo(i32*)</code> to <code>declare void @foo(i32* noalias align 4 dereferenceable(4))</code></p>



<a name="174078440"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174078440" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174078440">(Aug 25 2019 at 10:16)</a>:</h4>
<p>That means that even if the declaration of <code>declare void @foo(i32*)</code> would be correct, and code would use it correctly,  maaaaybe UB could happen - it is unclear to me what the impact of those attributes on the declaration is for optimizations</p>



<a name="174078453"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174078453" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174078453">(Aug 25 2019 at 10:17)</a>:</h4>
<p>looking at the IR of <code>good::baz(x)</code>, this function only calls a declaration, which requires <code>x</code> to be <code>noalias</code>, so AFAICT propagating all those attributes to <code>baz</code> argument would be ok</p>



<a name="174078455"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174078455" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174078455">(Aug 25 2019 at 10:17)</a>:</h4>
<p>but LLVM is not doing that</p>



<a name="174078508"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174078508" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174078508">(Aug 25 2019 at 10:18)</a>:</h4>
<p>That feels like a missed optimization though</p>



<a name="174133217"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174133217" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174133217">(Aug 26 2019 at 11:28)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> <span class="user-mention" data-user-id="124289">@rkruppe</span> shall we open a rust-lang/rust issue for the declaration/definition xLTO thingy ?</p>



<a name="174133451"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174133451" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174133451">(Aug 26 2019 at 11:32)</a>:</h4>
<p>I wonder whether a part of the issue that says that:</p>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="n">T</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="k">extern</span><span class="w"> </span><span class="s">&quot;Rust&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="k">fn</span> <span class="cp">$foo_mangled</span><span class="p">(</span><span class="n">x</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="o">&gt;</span><span class="p">);</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>


<p>is ok should be added to the reference.</p>



<a name="174133477"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174133477" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174133477">(Aug 26 2019 at 11:32)</a>:</h4>
<p>and the other issue should be used to track the bug.</p>



<a name="174133490"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174133490" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174133490">(Aug 26 2019 at 11:33)</a>:</h4>
<p>Or whether this being ok at all should be discussed first.</p>



<a name="174134598"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174134598" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174134598">(Aug 26 2019 at 11:53)</a>:</h4>
<blockquote>
<p><em>gnzlbg</em>: @RalfJ @rkruppe shall i open a rust-lang/rust issue for the<br>
declaration/definition xLTO thingy ?</p>
</blockquote>
<p>I think a UCG issue would make more sense?</p>



<a name="174135186"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174135186" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174135186">(Aug 26 2019 at 12:03)</a>:</h4>
<p>I'm not sure</p>



<a name="174135193"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174135193" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174135193">(Aug 26 2019 at 12:03)</a>:</h4>
<p>One thing is whether the code with the incompatible declarations is correct Rust code.</p>



<a name="174135253"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174135253" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174135253">(Aug 26 2019 at 12:04)</a>:</h4>
<p>I've got the feeling that either it is, or it should be (because otherwise too much code in the wild could be broken).</p>



<a name="174135263"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174135263" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174135263">(Aug 26 2019 at 12:04)</a>:</h4>
<p>I don't know if that would fit the reference, or rust-lang/rust, or the rfc repo, but UCGs feels too niche for that</p>



<a name="174135284"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174135284" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174135284">(Aug 26 2019 at 12:05)</a>:</h4>
<p>once that is settled, then what might remain is just the codegen bug that's already filled upstream</p>



<a name="174159508"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174159508" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174159508">(Aug 26 2019 at 17:13)</a>:</h4>
<p>(dang, I posted this via reply-by-email and that does not seem to put things into the right topic. sorry.)</p>



<a name="174159594"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174159594" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174159594">(Aug 26 2019 at 17:14)</a>:</h4>
<blockquote>
<p>once that is settled, then what might remain is just the codegen bug that's already filled upstream</p>
</blockquote>
<p>which codegen bug?</p>



<a name="174159621"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174159621" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174159621">(Aug 26 2019 at 17:15)</a>:</h4>
<blockquote>
<p>I don't know if that would fit the reference, or rust-lang/rust, or the rfc repo, but UCGs feels too niche for that</p>
</blockquote>
<p>the UCG would be the right place for figuring out the rules. if you think we have consensus on the rules, this might be more of a reference or nomicon thing.</p>



<a name="174167309"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174167309" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174167309">(Aug 26 2019 at 18:57)</a>:</h4>
<blockquote>
<p>which codegen bug?</p>
</blockquote>
<p><a href="https://github.com/rust-lang/rust/issues/46188" target="_blank" title="https://github.com/rust-lang/rust/issues/46188">https://github.com/rust-lang/rust/issues/46188</a></p>
<blockquote>
<p>if you think we have consensus on the rules, this might be more of a reference or nomicon thing.</p>
</blockquote>
<p>That boils down to whether we can say that this is ok or not:</p>
<div class="codehilite"><pre><span></span><span class="cp">#[no_mangle]</span><span class="w"> </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="o">*</span><span class="k">mut</span><span class="w"> </span><span class="kt">i32</span><span class="p">)</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="p">...</span><span class="w"> </span><span class="p">}</span><span class="w"></span>
<span class="k">mod</span> <span class="nn">maybe_bad0</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">     </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="nb">Option</span><span class="o">&lt;&amp;</span><span class="k">mut</span><span class="w"> </span><span class="kt">i32</span><span class="o">&gt;</span><span class="p">);</span><span class="w"> </span><span class="p">}</span><span class="w"> </span><span class="c1">// OK or UB ?</span>
<span class="p">}</span><span class="w"></span>
<span class="k">mod</span> <span class="nn">maybe_bad1</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">     </span><span class="k">extern</span><span class="w"> </span><span class="s">&quot;C&quot;</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="k">fn</span> <span class="nf">foo</span><span class="p">(</span><span class="n">x</span>: <span class="nc">NonNull</span><span class="o">&lt;</span><span class="kt">i32</span><span class="o">&gt;</span><span class="p">);</span><span class="w"> </span><span class="p">}</span><span class="w"> </span><span class="c1">// OK or UB ?</span>
<span class="p">}</span><span class="w"></span>
<span class="c1">// what if `foo` is defined in C? Does that change anything?</span>
</pre></div>



<a name="174167559"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174167559" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174167559">(Aug 26 2019 at 19:00)</a>:</h4>
<p>I expect it there to be so much code using <code>&amp;mut T</code>, <code>NonNull&lt;T&gt;</code>, or <code>Option&lt;&amp;mut T&gt;</code> where C expects <code>T*</code>, that if we make any of that UB all FFI code would break.</p>



<a name="174167590"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174167590" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174167590">(Aug 26 2019 at 19:01)</a>:</h4>
<p>(deleted)</p>



<a name="174167634"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174167634" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174167634">(Aug 26 2019 at 19:01)</a>:</h4>
<p>Also, that code has no <code>unsafe</code>, so... if we make it UB, safe Rust with <code>#[no_mangle]</code> _or_ linking C would have UB, which it arguably already has, but it would be just another footgun</p>



<a name="174167902"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174167902" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174167902">(Aug 26 2019 at 19:04)</a>:</h4>
<p>If that code is OK, is it OK to add <code>noalias</code> to <code>maybe_bad1::foo</code>'s argument ?</p>



<a name="174167919"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174167919" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174167919">(Aug 26 2019 at 19:05)</a>:</h4>
<p>Is it OK to add it to the <code>foo</code> definition ?</p>



<a name="174167944"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174167944" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174167944">(Aug 26 2019 at 19:05)</a>:</h4>
<hr>
<p>Looks like there are enough questions for opening an UCG issue :/</p>



<a name="174168142"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https%3A//github.com/rust-lang/rust/issues/63787/near/174168142" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/https.3A.2F.2Fgithub.2Ecom.2Frust-lang.2Frust.2Fissues.2F63787.html#174168142">(Aug 26 2019 at 19:08)</a>:</h4>
<p>;)</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>